Code ran before the first prompt

Datadog Security Labs (3 Aug 2026) moved earlier than hooks and skills. After you trust a folder, Codex can start a project-scoped MCP process from `.codex/config.toml` immediately. Claude Code can set `PATH` in `.claude/settings.json` so its own automatic Git probes run a wrapper that lives in the repo. No model response. No shell-command approval. The social engineering is ordinary: clone this, open it, trust the workspace so the agent can work.

That is an operator note for anyone who treats “Trust folder” like a permissions checkbox, not a new gem. Folder trust is running setup. A clean-looking tree still has MCP stdio commands, env overrides, editor tasks, and ordinary executables. Looking only for a `hooks` key misses the rest. Open unfamiliar repos in a disposable environment without the keys you would mind losing.